tests: pause-add rotation corruption + dup-id, log bugs to TODO

- turn.pause-add.test.js: 3 tests isolating addParticipant+pause/resume
  interaction. Clean minimal repro passes (bug needs more state than
  single add+pause). Audit authoritative repro.
- turn.characterization.test.js: RED 'addParticipant rejects duplicate id'.
  Validates current allow-dup behavior.
- TODO.md: BUG-1 (add+pause rotation corruption, 32/100 audit violations),
  BUG-2 (dup id allow). Both confirmed real, NOT fixed.

Audit bisect: dmg+heal+cond+toggle+remove+add+pause = 32 violations.
add+pause alone = 0. Combo needs full state.

No feature code changed.

scripts/audit-rotation.js

@@ -62,7 +62,7 @@ for (let roundN = 1; roundN <= ROUNDS; roundN++) {
   const cap = (enc.participants.length + 2) * 2;
   let guard = 0;
 
-    // BISECT: testing damage+heal+pause
+    // BISECT: dmg+heal+cond+add+pause
     const actor = enc.participants.find(p => p.id === enc.currentTurnParticipantId);
     if (actor) {
       const foes = enc.participants.filter(p => p.id !== actor.id && p.currentHp > 0 && p.isActive !== false);